- Home
- Techniques
- Mobile
- Delete Device Data
Delete Device Data
Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have administrator access to fully wipe the device, while individual files may not require special permissions to delete depending on their storage location. [1]
Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats. The impact file deletion will have depends on the type of data as well as the goals and objectives of the adversary, but can include deleting update files to evade detection or deleting attacker-specified files for impact.
Procedure Examples
| Name | Description |
|---|---|
| Agent Smith |
Agent Smith deletes infected applications’ update packages when they are detected on the system, preventing updates.[2] |
| Desert Scorpion |
Desert Scorpion can delete copies of itself if additional APKs are downloaded to external storage.[3] |
| FlexiSpy | |
| GolfSpy | |
| Mandrake | |
| Monokle |
Monokle can delete arbitrary files on the device, and can also uninstall itself and clean up staging files.[7] |
| Pallas |
Pallas has the ability to delete attacker-specified files from compromised devices.[8] |
| ViceLeaker |
ViceLeaker can delete arbitrary files from the device.[9] |
| WolfRAT |
Mitigations
| Mitigation | Description |
|---|---|
| Application Vetting |
Application vetting services could be extra scrutinous of applications that request device administrator permissions. |
| Caution with Device Administrator Access |
There are very limited circumstances under which device administrator access should be granted. |
| User Guidance |
Users should be trained on what device administrator permission request prompts look like, and how to avoid granting permissions on phishing popups. |
Detection
Mobile security products can detect which applications can request device administrator permissions. Users can view applications with administrator access through the device settings, and may also notice if user data is inexplicably missing.
References
- Android Developers. (n.d.). DevicePolicyManager. Retrieved September 22, 2019.
- A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.
- A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.
- Actis B. (2017, April 22). FlexSpy Application Analysis. Retrieved September 4, 2019.
- E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.
- R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.
- Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.
- Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
- GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
- W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back... . Retrieved July 20, 2020.